[BUG] Deleting a dry-run NodeReadinessRule removes matching pre-existing taints

What happened?

A NodeReadinessRule that was created with dryRun: true and never entered enforcement removes a matching pre-existing Node taint when the Rule is deleted.

Normal dry-run reconciliation does not mutate the Node, but deletion reaches finalizer cleanup before the dry-run branch. reconcileDelete then removes matching taints from selected Nodes:

• deletion is handled before dry-run
• deletion cleanup removes matching taints

This violates the documented dry-run contract that no taints are applied or removed.

Steps to reproduce

1. Label and taint a test Node:

kubectl label node <node> dryrun-delete-repro=true
kubectl taint node <node> readiness.k8s.io/dryrun-delete-repro=preexisting:NoSchedule

2. Apply this Rule:

apiVersion: readiness.node.x-k8s.io/v1alpha1
kind: NodeReadinessRule
metadata:
  name: dryrun-delete-repro
spec:
  dryRun: true
  enforcementMode: continuous
  nodeSelector:
    matchLabels:
      dryrun-delete-repro: "true"
  conditions:
    - type: example.com/TestReady
      requiredStatus: Unknown
  taint:
    key: readiness.k8s.io/dryrun-delete-repro
    value: preexisting
    effect: NoSchedule

3. Wait for status.dryRunResults, confirm the taint still exists, then delete the Rule:

kubectl delete nodereadinessrule dryrun-delete-repro --wait=true
kubectl get node <node> -o jsonpath='{.spec.taints}'

The pre-existing taint is removed.

Expected behavior

Deleting a Rule that remained in dry-run for its entire lifetime must not add, update, or remove Node taints. The finalizer and controller-local state may still be cleaned up normally.

This report intentionally covers only the unambiguous always-dry-run case. Lifecycle behavior for a Rule that previously entered enforcement is discussed separately in the comments.

Environment

• Controller: nrc-local:021cd1d
• Main inspected: af1f57d587fbf445d61aa7cfc741f8c96a2f5a44
• Kubernetes client: v1.35.2 (darwin/arm64)
• Kubernetes server: v1.36.1 (linux/arm64, Kind)

/kind bug